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ABSTRACT 


Current safeguards approaches used by the International Atomic Energy Agency (IAEA) at gas 
centrifuge enrichment plants (GCEPs) need enhancement in order to verify declared low-enriched 
(LEU) production, detect undeclared LEU production and detect highly enriched uranium (HEU) 
production with adequate detection probability using nondestructive assay (NDA) techniques. At 
present inspectors use attended systems, systems needing the presence of an inspector for operation, 
during inspections to verify the mass and 351) enrichment of declared UF, containers used in the 
process of enrichment at GCEPs. In verifying declared LEU production, the inspectors also take 
samples for off-site destructive assay (DA) which provide accurate data, with 0.1% to 0.5% 
measurement uncertainty, on the enrichment of the UF, feed, tails, and product. However, taking 
samples of UF¢ for off-site analysis is a much more labor and resource intensive exercise for the 
operator and inspector. Furthermore, the operator must ship the samples off-site to the [AEA 
laboratory which delays the timeliness of results and interruptions to the continuity of knowledge 
(CofK) of the samples during their storage and transit. This paper contains an analysis of possible 
improvements in unattended and attended NDA systems such as process monitoring and possible 
on-site analysis of DA samples that could reduce the uncertainty of the inspector’s measurements 
and provide more effective and efficient [AEA GCEPs safeguards. We also introduce examples 
advanced safeguards systems that could be assembled for unattended operation. 


INTRODUCTION 


The International Atomic Energy Agency currently safeguards large LEU (<20% enriched **°U) 
GCEPs in several countries. Currently, the IAEA uses the same basic approach to safeguard 
GCEPs that the Hexapartite Safeguards Project (HSP) recommended in 1983 with some 
enhancements in the large URENCO facilities in Europe.'* However, the GCEPs safeguards 
approaches in China, Brazil, and Iran are different. Furthermore, the [AEA will modify the GCEPs 
safeguards approach in Japan for the restart of the updated Japanese GCEP plant. There is also 
major expansion in the use of URENCO centrifuges. Since Areva bought into URENCO 
technology, Areva and have a 50% share in the actual centrifuge technology but do not share plant 
operational technologies such as those used in UF, feed handling and product withdrawal. Hence, 
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URENCO USA? in Eunice, New Mexico (URENCO/Louisiana Energy Services), Eagle Rock in 
Idaho Falls, Idaho (Areva), and Georges Besse II (GB IL) in Pierrelatte, France (Areva) will be 
basically URENCO centrifuge plants with respect to the actual centrifuge technology where HSP 
safeguards would be applicable. It may be argued that the [AEA’s application of HSP safeguards at 
these new facilities, which are located in Nuclear Weapons States (NWS), will demand significant 
resources that could be used more effectively in non-Nuclear Weapon States. However, in the spirit 
of nondiscrimatory safeguards’, some type of equivalent safeguards approach is needed in France, 
the United States, and the other NWS. In addition, improved GCEPs safeguards approaches are 
needed for deployment in any State. An advanced safeguards approach should offer more effective 
and efficient safeguards than present HSP safeguards provide. 


We shall review the basic safeguards concerns associated with LEU GCEPs before introducing our 
advanced safeguards systems concepts. Three principal safeguards concerns for nuclear material 
diversions from LEU GCEPs include: 


1. Production and diversion of a significant quantity of uranium with enrichment greater than 
declared (in particular, HEU with >20% a9 U), 


2. Diversion of a significant quantity of declared uranium (particularly in the form of LEU 
product), 


3. Production and diversion of LEU in excess of declared amounts (e.g., using undeclared 
feed). 


The detection of undeclared HEU production is of greatest concern, since HEU can be directly used 
in nuclear weapons. Detection of the diversion or production of undeclared quantities of LEU is 
also crucial for two reasons. First, LEU can be further enriched to HEU either clandestinely in a 
LEU GCEP or in a separate undeclared facility. Second, LEU can be used to fuel a reactor for the 
production of plutonium. The amount of separative work, expressed in separative work units 
(SWU), required to enrich natural uranium to 5% 351) is about 4200 tSWU. It only takes about 
1200 tSWU more work to enrich that 5% 7°°U to 90% **°U. Hence, enriching LEU feedstock to 
HEU instead of enriching natural uranium feedstock to HEU reduces to about one-quarter the 
separative work required to enrich the natural uranium all the way to 90% 351) (5400 tSWU). Thus, 
a clandestine cascade designed to produce HEU from LEU is smaller and more easily concealed 
than a full-scale cascade designed to produce HEU from natural uranium. The HSP safeguards 
approach explicitly addresses the first two diversion concerns but does not address the third concern 
which centers on “undeclared feed.” In this scenario, an operator would bypass IAEA inspection 
and introduce undeclared UF, feedstock into a GCEP. The operator would then remove the 
undeclared product for use in an undeclared HEU cascade in the same facility or in a clandestine 
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HEU enrichment facility. The operator would ensure that his material accountancy would not 
reveal the undeclared feed, undeclared product, and depleted tails by falsifying the books and 
ensuring any discrepancies in enrichment values or material amounts would be undetectable by 
IAEA safeguards.‘ 


The IAEA moved in recent years to cover this gap in the GCEPs safeguards approach by rolling out 
a new model safeguards approach which includes randomized inspections and the use of the 
“Mailbox” concept as safeguards tools to enable the detection of undeclared operations.” A field 
trial was held at the URENCO Gronau GCEP in Germany to examine the practicality of measures 
associated with this approach.° The field trial successfully demonstrated the concept as had earlier 
trials at the Portsmouth Gaseous Diffusion Plant in the 1990s to verify HEU downblending.”® This 
paper looks at how evolving concepts of the use of unattended NDA could enhance GCEPs 
safeguards and facilitate a more effective mailbox system by providing remote unattended 
verification of the operator’s mailbox declaration on a daily basis. These approaches should not 
only be applicable to the URENCO facilities but should be applicable to other GCEPs under 
safeguards or to those which may come under safeguards in the future. 


The IAEA has also published its goals” for an advanced GCEPs safeguards system that would 
include implementing information-driven safeguards; remote inspections; reduced frequency and 
inspection effort at facilities; reduced impact on operators to support inspections; enhanced 
detection probability of undeclared production of LEU; and improved timeliness and efficiency of 
detecting HEU production. Colleagues at Oak Ridge National Laboratory have evaluated the use of 
remotely acquired data to trigger inspections at a GCEP in an attempt to reach the goals stated 
above by expert analysis of the remotely acquired data and by using the results of that analysis to 
draw a conclusion that an inspection is needed to investigate anomalous data from the plant.'° Our 
work in this study looks at the application of some of the advanced systems under consideration, 
what their performance could be, and how they could help reach the IAEA’s goals for advanced 
GCEPs safeguards. 


OPERATOR’S DIVERSION SCENARIOS AND INSPECTION NEEDS 


For the IAEA to have capabilities in remote and/or unattended NDA operation with automated 
measurements and monitoring,’’ a new generation of instruments will need development, testing 
and implementation. These instruments will need to be robust, improving the quality of the NDA 
measurements done at GCEPs. The IAEA envisions these instruments to be complemented by 
unannounced inspections, Additional Protocol complementary access (CA) activities, and the 
application of new and novel technologies. 


These new instruments should attempt to decrease the uncertainties associated with NDA and DA 
measurements done at GCEPs because large uncertainties associated with the operator’s or the 
inspector's measurements produce large uncertainties in the material amounts verified. For 
instance, an operator can divert material by having measurement uncertainties that are large enough 
that the material unaccounted for (MUF) over the course of the annual material balance period is 
big enough, compared to the throughput of the GCEP, to hide diversion of a significant quantity 
(SQ) in the noise of measurement uncertainties.'* This diversion strategy is known as diversion 
into MUF and the operator can falsify records or remove all or partial amounts of UF, from 
cylinders to get a SQ of enriched material. The second diversion strategy is for an operator to 
remove the material without falsifying the records and to depend on the large measurement 
uncertainties associated with the inspector’s instruments to obscure the diversion. This is known as 
diversion into D (the overall operator—inspector difference statistic) where operator—inspector 
difference, dj, is defined as: 


d; = [O; - [i]/ O; (1) 
where: 


Oj; = Operator declaration for item i 
I; = Inspector verification measurement of item i. 


If the D statistic is larger than expected, then the IAEA can detect the diversion. The IAEA also 
attempts to detect diversion with the MUF-D statistic, also known as the “inspector’s estimate of 
MUF.” The sensitivity of the MUF-D statistic depends on the extent of the verification of the strata, 
natural, enriched, and depleted uranium in GCEPs, in the four factors of the material balance 
equation, shown below, that defines MUF as: 


MUF = PB+ X — Y - PE (2) 
where: 
PB = physical inventory at the beginning of the period; 
X = sum of the nuclear-material increases into the MBA during the MBP; 
Y = sum of the nuclear-material decreases of the MBA during the MBP; 
PE = physical inventory at the end of the period, measured during the Physical 
Inventory Taking (PIT). 


The MUFs are calculated for both elemental uranium and the *°U isotope. The IAEA applies the 

uncertainties associated with the measurement system used to determine the declared amounts of 

material, which make up each of the above four components of the material balance equation to the 
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item or stratum amounts to determine the uncertainty of the material balance (Omur). The LAEA 
sets its limit of the error of MUF at twice Oqur (20mur) with a 5% chance of false alarm and the 
diversion alarm level at three times Our (36mur) With a 50% probability of detection and a 99.73% 
confidence level. The threshold of 30,ur is set to lower the chance of false alarms of diversion. 
Hence, if the operator diverts an amount of material corresponding to greater than 30qur, he will 
have a 50% chance of being detected. 


The IAEA expects that the operator’s material balance uncertainty has a combined uncertainty of 
one Relative Standard Deviation (RSD), 5s, of 0.2% error, which is the smallest uncertainty 
expected by the IAEA in any of the bulk handling facilities.'? It should be noted that an enrichment 
plant of 3000 MtSWU/yr with 7*°U enrichment of the feed = 0.711%, product = 5.0%, and tails = 
0.34%, is typical of the lower end of the base scale of the large new GCEP facilities coming on line 
either as new construction or older plant expansion. However, as shown in Table 1, the operators of 
most of these plants currently are expanding or planning to expand their capacities to 5000-6000 
MtSWU/yr with Areva’s GB II topping out at 8200 MTSWU/yr. Hence, for even the low 
uncertainty of 0.2% error in a large GCEP, there exists the possibility of the operator hiding a 
diversion in the noise of the uncertainties of the material balance. These uncertainties will exceed a 
one SQ threshold in these cases. Our analysis here spans the range of plants, as documented in 
Table 1, from 500 MtSWU/yr to 9000 MtSWU/yr (five cases = 500 MtSWU/yr, 1000 MtSWU/yr, 
3000 MtSWU/yr, 6000 MtSWU/yr, and 9000 MtSWU/yr) and gives a rough estimate of the needs 
for advanced safeguards versus how conventional HSP safeguards have been implemented. Table 2 
shows the yearly material and cylinder throughputs for the five cases and the yearly Omur for each 
plant which in the larger plants exceeds 1 SQ. It can be seen that our effort to create the base plant 
and scaling up the plants by an integer number of cylinders from the base case of 500 MtSWU/yr 
gives a value of separative work for each of the five model GCEPs about 5% under the declared 
capacity of the plant. The goal of this exercise is not to evaluate plants at exactly the value of the 
five GCEPs but in the range of such facilities to be able to design and evaluate workable advanced 
safeguards approaches for large GCEPs. 


It is evident that the large scale facilities such as GB II and the planned final full-scale URENCO 
USA*-LES plant in Eunice, NM will move 500-800 SQs of enriched LEU out the door each year. 
We can see that even small uncertainties in measurements can lead to multiple SQs of material 
possibly being diverted in the noise of verification activities. Hence, advanced safeguards should 
provide not only better accountancy measures for verification but process monitoring and 
containment and surveillance measures as assurance that material has not been diverted. 


TABLE 1: Large Scale Enrichment Plants in Operation, Construction, or Planning 


ENRICHMENT PLANT 


URENCO - Capenhurst, UK (operation) 


CAPACITY 
MtSWU/yr 


5000 


URENCO - URENCO USA* - LES — revised final USA (planned) 5700 
GE-H GLE (LASERS) USA (planned) 


TABLE 2: Yearly Material and Cylinder Throughputs of Facilities for Study 


Material Quantity {| 500 | 1000 | 3000 | 6000 | 9000 _| 
234 | 702 
118 354 708 1062 
210 630 1260 1890 
Product (kgU/Yr) 1.4E+05 4.3E+05 
8.26+05| 1.66406) 4.9E+06| 9.86406 _1.5E+07| 
6.36+03| 1.36404 
3.5E+03 7.1E+03 | 2.1E+04 4.3E£+04 6.4E+04 
2.8E+03 5.6E+03 | 1.7E+04 3.3E+04 5.0E+04 
94.5 283.4 566.9 
222.8| 445.6| 668.4 | 
LOwdke’*u) | 8 | 26 | 76 152 


1.1E+07 | —_—:1.6E+07 
8.5E+05 1.3E+06 | 


ACCOUNTANCY VERIFICATION UNDER STANDARD HSP SAFEGUARDS 


The IAEA uses a three tier set of verification methods for gross, partial, and bias defects in the 
random sampling plan to gain the level of detection probability for a facility and nuclear material in 
question.'* The IAEA defines the number of total samples, ng, as: 


ty = Nirem(1- B™) (3) 


where: 
ns = total sample size 
Nitem = the number of items in a stratum 
6 = non-detection probability = 1- Pp 
m = M/x 
M = goal amount, kgU of 7°U = 75 kgU of **°U for LEU 
X = average nuclear material weight of an item in the stratum, kgU of me 


The sample size, n,, is then split between gross, partial, and bias defect measurements which is 
determined by weighting the size of the uncertainties in the following equation for total (relative) 
measurement uncertainty, 6;: 


5, = (80° + 8)” (4) 


where: 
do = Operator error component 
5; = inspector error component 


The IAEA calculates these numbers over the different uncertainty ranges for gross, partial, and bias 
defect measurements. Table 3 shows the desired ranges of the gross, partial and bias defect 
measurement uncertainties for operator—inspector measurement systems. 'S An international team of 
NDA and DA experts evaluated the various verification methods and established target values for 
operator and inspector measurement systems known as the International Target Values (ITVs), 
which state under nominal good NDA or DA practices what uncertainty values can be achieved 
with each technique. '® Hence, we can calculate what the sample sizes would be for the material 
throughput for our five model GCEPs described in Table 2, for various safeguards approaches noted 
in Table 4. We note that we define three quantities for measurements in for GCEPs safeguards. 
There is the NDA sample measurement for 7°U enrichment which is a gross or partial defect 
measurement for GCEPs. There is the DA sample measurement for *°U enrichment which is a bias 
defect measurement for GCEPs. Finally, there is the mass weighing of the UFs which by assuming 
a constant stoichiometric value of 0.6761 for the uranium composition of UF¢ and multiplying this 
value times the UF¢ weight produces the uranium mass. The mass weighing is either a partial or 
bias defect measure. Each measurement contents a random and a systematic uncertainty. 


TABLE 3: Operator/Inspector Measurement System Recommended Error Limits 


METHOD INTERPRETATION RELATIVE ERROR | DETECTABLE 
CODES RANGES DEFECT SIZE 
H 


Quantitative through NDA (Verification in | 0.0625 <8< 0.125 GROSS 
(Gross the attribute mode using the least 
Defect) accurate method), or 


Qualitative through NDA Error can’t be assigned | GROSS 


F Quantitative through NDA (Verification in | 0.010 <8;< 0.0625 PARTIAL 
(Partial the attribute mode using a better 
Defect) accurate method) 
E Quantitative through NDA (Verification in 
(Bias Defect) | the variables mode using the most 
accurate method) e.g. 
Quantitative through DA (Verification in 
the variables mode using the most 
accurate method) 


D 
(Bias Defect) 


TABLE 4: Target Values for Advanced Safeguards Concepts at GCEPs 


ATTENDED UNATTENDED UNATTENDED UNATTENDED 
STD HSP MSSP SPEC NEUT DET AEM ACC 


26] 5] 5 


Uncertainties 


Weight 
Uncertainties 


The first case, the standard HSP attended inspector inspection approach using the ITVs for 
instrument performance (Table 4 (Concept A - STD HSP) column), is the base case to compare 
against the advanced safeguards approaches under development. Assuming the 50% probability of 
detection prescribed by the JAEA for all three strata, Tables 5 through 9 show the sample sizes for 
the HSP safeguards approach, marked Concept A, using inspector attended monitoring systems for 
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gross and partial defects. The [AEA uses Nal detectors for 7*°U enrichment measurements for feed 
and tails, HPGe detectors for 7*°U enrichment measurements for product, and thermal ionization 
mass spectrometry (TIMS) for DA. The IAEA uses authenticated operator scales or inspector load 
cell-based weighing systems for uranium weight. Because of the large values for tails uncertainty 
for NDA, the IAEA would need to take large numbers of tails DA samples and large numbers of 
feed samples which make the GCEP safeguards tedious and labor intensive for both inspector and 
operator. We can see as the plant size expands, the taking of DA becomes prohibitive with time and 
effort involved in taking and analyzing DA samples. The analysis of these DA samples can be an 
expensive and time-consuming part of GCEPs safeguards. 


Since the IAEA sees the future of verification as being the use of unattended and possibly remotely 
monitored NDA systems even doing inspections remotely, the U.S. DOE laboratory research 
teams!’ are exploring some concepts as including the use of the operator’s load cells and 
accountancy scales’, neutron detectors for enrichment and mass", tracking of cylinders to ensure 
CofK of a specific cylinder and its contents”’, and advanced enrichment monitoring.”’ The 
specifications for such a system with unattended flow and monitoring capabilities are seen in 
Concept B - MSSP SPEC in Table 4. The specifications of Concept B come from the IAEA’s 
Member State Support Program (MSSP) task requesting a study to investigate building a system 
with has the same performance as present attended NDA systems with the advantage of no inspector 
labor to operate the systems and a mass measurement capability that has on the order of 10-20% 
random error and 2-6% systematic error over all three strata.** The IAEA could duplicate the 
performance of the standard HSP safeguards in unattended mode especially assuming the 
withdrawal system in a large plant is spread over 4-10 production units as opposed to one huge 
production unit with one withdrawal system. Hence, by spreading the real time material balance 
across 1-9 production units having unconnected UF, handling stations, the unattended system 
would be more sensitive than if one central UF, handling station fed and withdrew all of the UFg in 
the plant. Hence, by spreading out the UF, handling across assay units of 1000 MtSWU/yr it takes 
longer for a single product cylinder to be filled since all of the assay units cannot fill a single 
cylinder. The prescribed uncertainties of the unattended mass measuring system in Concept B will 
be less accurate than weighing the UF, on the IAEA’s load cells or operator accountancy scales. 
Hence, this higher uncertainty in mass measurement corresponds to an increased need for DA 
samples to get the same performance as in HSP safeguards even with similar enrichment 
measurement uncertainties. 


However, with verification of all UF, material introduced into and withdrawn from the cascades 

combined with random inspections and design information verification, we could gain much greater 

confidence that no undeclared feedstock is being used and no undeclared product is being produced. 

The IAEA could also state that by covering the undeclared feed diversion pathway perhaps only a 

limited number of DA samples taken at random inspections at a random low-low level, i.e., the 
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IAEA’s lower than random low probability of detection value of “Random Low-Low” with Pp = 
10%, during the year could suffice to verify **°U at the bias defect level. The remote system in 
Concept B giving 100% undeclared activities verification and 100% gross and partial defect 
verification would complement the bias defect measure and provide a reason to relax the bias defect 
standard. Hence, this monitoring of 100% of the cylinders is greater than the [AEA’s random high 
detection range (Pp =90%) with 100% coverage of the cylinders for gross and partial defects and 
provides 100% check on undeclared feed and complementary knowledge of the enrichment and 
flows in the plant. This gives the IAEA confidence that fluctuations in enrichment and flow are not 
occurring because of undeclared feeding and withdrawing of UFs. Concept B calculations, shown 
in Table 3, show that Pp =10% level of DA samples, shown in the parentheses in the DA samples 
rows, is only 16% of the amount needed for Pp = 50%. The IAEA could take these 24 DA samples 
with ease during 4-6 random inspections during the year. 


We do not propose any systems for Concept B here but only calculate the sampling needs of a 
system with this performance. In the coming paragraphs we will describe two possible systems 
which, in fact, we predict could exceed the Concept specifications. Starting with the Concept B 
unattended system specifications and the [AEA’s Operations Division B description of its needs and 
desires for advanced unattended GCEPs safeguards capabilities"? we have created these two NDA 
systems that could be applied to a GCEP. It could be possible to have both in place to provide a 
means of cross-checking the data and giving assurances of the authenticity of the data or using each 
one independently. Concept C - NEUT DET in Table 4 uses NDA and mass measurement 
capabilities from passive neutron measurements. 


One neutron detection system developed at LANL provides the mass of uranium in UF¢ cylinders. 
It uses total neutron counting, assuming a known enrichment, to give the mass in lieu of or to 
authenticate the load cell or accountancy scale mass at a GCEP. UFg produces neutrons primarily 
from !°F(a,n)”"Na reactions and **U spontaneous fission. In enriched uranium, 44) is the dominant 
a-emitter and, hence, indirectly the principle source of neutrons in UF,.* In general, the 
enrichment of ***U follows that of *°U in centrifuge enrichment processes. If the enrichment is 
known, then the mass of uranium can be determined from the total neutron count rate. 


The detector can determine uranium mass in feed, product, and tails cylinders. The data analysis 
assumes a known *U/?°U ratio and ore-based feed (i.e., not from reprocessed fuel). Computational 
modeling studies provided an estimate of the total measurement uncertainties. The random 
uncertainty due to counting statistics should be less than 1%. Systematic uncertainties arise from the 
distribution of the UF, within the cylinder, calibration error, variations in the “*U/U ratio, and 
background effects. The unknown source distribution creates the largest source of systematic 
uncertainty. The estimated total systematic uncertainty is 5-6%. For our study here we have chosen 
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a random uncertainty of 1.5% and a systematic uncertainty of 6.5% for the weight measure for all 
three strata as a conservative estimate for the system. 


In addition to the mass of UF within a cylinder, another component of the system under 
development at LANL will be used for determining uranium enrichment. It uses total neutron 
counting to verify the load cell mass. Preliminary modeling studies show that both the doubles-to- 
singles ratios as well as the cadmium ratio are useful relationships for determining enrichment in 
UF, cylinders. Currently, work is focused on optimizing the design and data analysis method. 
Although the design is not yet finalized, the projected uncertainty estimates are 2% random and 5% 
systematic which are used for the enrichment uncertainty for the product stratum in this study. We 
took a weighting of 1.29 and 1.6 multiplied by the 2% of the product to estimating the uncertainty 
for the feed and tails strata, respectively. Hence, we assumed degradation in accuracy with lower 
enrichment than LEU so that the feed and tails have an uncertainty of 2.6% and 3.2%, respectively. 
We used a systematic uncertainty of 5% for the enrichment measure for all three strata as a nominal 
achievable goal for the system. 


We envision a system that could be built onto the trolley that moves the cylinders from the storage 
areas to the feed/withdrawal stations or as a portal monitor system. The measurements could be 
made during the periods between loading feed into the heating boxes or prior to moving the product 
and tails to storage areas after they are moved from the cooling boxes. The load cells in the heating 
and cooling boxes provide a backup and authentication of the cylinder uranium weight as measured 
by the neutron detection system. The challenge of using the load cells is how to analyze the load 
cell data and how to ensure that proprietary information about feed and withdrawal operations is 
protected. During the December 2009 enrichment conference in Chester, United Kingdom, 
URENCO officials made the issue of the proprietary nature of this load cell information a possible 
stumbling block to the use of the load cells. At a minimum, the load cells would count cylinders 
being placed in the heating or cooling boxes and would show if a cylinder was empty or full. This 
100% gross defect test of the cylinders and check on operator mailbox declarations would be an 
improvement over what is available to inspectors now for undeclared LEU production and on any 
mailbox scheme that depends on short notice random inspections (SNRIs). The number of SNRIs 
needed as plants increase in size to be statistically relevant in detecting undeclared activities at a 
50% probability of detection can be large. In fact, the number of SNRIs can be so large, 30-40 
SNRIs per year or more, as to be virtually indistinguishable from a resident inspector in scope of 
labor and travel costs for the inspectorate and intrusiveness for the operator. The system can act as 
the SNRI or Unannounced Inspection (UI) during a remote inspection and remove both the 
inspector cost and intrusiveness to the operator while providing more meaningful operational 
information. 


The IAEA and the operators have shown a desire to build a safeguards approach around use of the 
operator’s accountancy scales for weight measurements and an advanced enrichment monitor for 
*35UJ enrichment. This is our Concept D - AEM ACC for Advanced Enrichment Monitor (AEM) 
and use of accountancy scales and load cells. This concept uses authenticated operator accountancy 
scales to get the mass of the UFg in the cylinders in an unattended mode and an Advanced 
Enrichment Monitor (AEM) at the headers feeding or withdrawing from the cascades to measure 
the enrichment of UFs. Hence, this system will have the enrichment of the feed, product and tails 
cylinders available without having to physically measure each cylinder. We have assumed that the 
performance goals of this system, as shown in Table 4, will have low uncertainties in the AEM (1-— 
2% for both random and systematic uncertainties in all three strata with the performance degrading 
with decreased enrichment) and the accountancy scales have the uncertainties for such a 
measurement system documented in the ITVs. 


One of the challenges of the unattended system is to insure that a cylinder declared as being 
attached to the process and measured by process load cells can be authenticated to be the same 
cylinder declared by the operator to be measured by the neutron system or the accountancy scales. 
This system could benefit from a cylinder tracking system to match cylinders to the stations they 
entered or exited. The integrated load cell data from the autoclave or hot box can provide a backup 
mass value to verify the operator accountancy scale mass data if the system can be designed in such 
a way to protect proprietary UF. mass flow data. Howell, DelBeke, and others have investigated 
analysis of the data and how to use it to draw conclusions about the diversion of UF, from the 
plant.*°® Algorithms to tie the load cell data to accountancy scale data can “cross” authenticate the 
cylinder weights by having two independent verification methods, such as load cells and 
accountancy scales, check each other. Implementing Concepts C and D together would provide an 
independent means of nondestructively measuring both uranium mass and *°5U) enrichment while 
comparing these measurements against load cell data and cylinder count in near real-time. It would 
be difficult for the operator to fool the neutron detector, the accountancy scales, the load cells, the 
neutron detector, and the AEM without producing anomalous data. Lebrun from the IAEA is a 
champion of this “defense in depth” “cross” authentication approach for verification.” 


When we look at the data from the results in Tables 5 through 9 for all four safeguards concepts and 
for the range of the five GCEPs, we see several important patterns. Because of the lower 
uncertainties inherent in the detectors used in attended inspections in Concept A, the sampling plan 
demands a certain number of DA samples to reach the PD=50%. This number is not so prohibitive 
in the case of the 500 MtSWU/yr plant with 20 total DA samples to be taken, but as plant capacity 
increases this number becomes a concern. With plants in 3000-9000 MtSWU/yr range, which are 
operating and under construction today, the number of DA samples ranges from 116-345. An 
inspector doing monthly inspections would need to take between approximately 10-30 samples for 
DA at each inspection. Sampling for DA is very time consuming and intrusive to operations and at 
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6000-9000 MtSWU/yr plants would require significant IAEA resources. Concept B actually makes 
this situation worse since the IAEA specifications for mass measurement have much higher 
uncertainties than are seen in attended inspections. Hence, if we stick to having bias defect 
measurements in the unattended modes, a lot of inspection effort will still be needed just to collect 
the DA samples. The Concept C and D systems do reduce the number of DA samples needed. 
However, for Concept C this brings down the number to about 3/4 of the Concept A values for DA 
samples. We note that Concept D brings down the DA samples to approximately 1/6 of those 
required by Concept A. Hence, if the AEM concept can deliver this performance even a 9000 
MtSWU/yr plant would need only 58 DA samples/yr or approximately 5 DA samples/month with 
12 inspections/yr. 


TABLE 5: Sampling Plans for Advanced Safeguards Systems at 500 MtSWU/yr GCEP 
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TABLE 6: Sampling Plans for Advanced Safeguards Systems at 1000 MtSWU/yr GCEP 
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TABLE 7: Sampling Plans for Advanced Safeguards Systems at 3000 MtSWU/yr GCEP 
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TABLE 8: Sampling Plans for Advanced Safeguards Systems at 6000 MtSWU/yr GCEP 
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TABLE 9; Sampling Plans for Advanced Safeguards Systems at 9000 MtSWU/yr GCEP 
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One of the aims of the advanced safeguards approaches is for the IAEA to be able to depend on the 
remote unattended systems to replace the labor of the inspectors and to reduce both the length and 
frequency of inspections at GCEPs. We noted that Concept C could reduce the need for DA 
samples by around a third and Concept D could reduce the need for DA samples substantially by 
around 5/6". We stated above that the 100% coverage of all strata with gross and partial defect tests 
with the attended system gives us confidence that the operator cannot introduce undeclared 
feedstock or remove undeclared product LEU. Hence, we could make a case for relaxing the bias 
defect sampling requirement from PD=50% to PD=10% for Concepts B, C, and D as shown in 
Tables 5-9. Tables 7-9 show that this relaxation in probability of detection for bias defects results 
in Concept C and D DA samples for GCEPs with capacities of 3000-9000 MtSWU/yr plummeting 
from a range of 116-345 total DA samples in all three strata with PD=50% in the Concept A 
attended mode to 25-39 DA samples with PD=10% in all three strata in Concept C and 4-10 DA 
samples with PD=10% in all three strata with Concept D. Hence, we can propose with the bias 
defect test having PD=10% that the [AEA could do 4-6 UI on a random basis each year. During 
each inspection the inspectors would check the remote systems for tampering, do spot weighing of 
1-6 selected cylinders, and take only DA samples from those same cylinders. The actual sample 
number, i.e., 1-6, would depend on the plant throughput and system performance as seen in the 
calculations. However, even taking the maximum 6 DA samples and spot check weighing during 4- 
6 inspections is not an onerous load over an inspection lasting two-three days with 2-3 inspectors. 
We note that inspector will need to do more work if they find the unattended system is not 
functioning nominally. More research is needed to develop a strategy to recover from a system 
malfunction or operator tampering between inspections. 


With further respect to the DA samples, if the IAEA could use an on-site DA method, it would 
improve timeliness and reduce the chance of the loss of CofK. Since present GCEPs safeguards 
require the storage of DA samples on site for the entire material balance period, the risk of loss of 
CoK of the whole DA sample batch is credible if the seals on the storage cabinet are accidently 
broken or deliberately compromised. Furthermore, it can take months for the samples to be shipped 
and analyzed making it difficult to have timely conclusions for the material balance period. Hence, 
a technique for on-site DA of samples with comparable low uncertainties as can be obtained with 
TIMS or gas source mass spectrometry (GSMS) would be desirable for development for the IAEA 
to use at a GCEP. The IAEA is pursuing such a strategy with the development of an instrument 
based on Tunable Diode Laser Spectrometry.” Furthermore, an NDA technique with uncertainties 
less than or equal to 1% that could be used as a bias defect tool, as described as Method E in Table 
3, would also be desirable because it would be easier than taking DA samples and analyzing the 
samples. If the AEM performs as hoped it may be able to provide performance comparable to 
Method E. However, an intermediate option may be a NDA technique that could be used on the 
sample bottles on-site and during an inspection. If we pursue the course of taking bias defect DA 
samples at the 10% probability of detection level with an immediate on-site Method E measurement 
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of the sample bottle, the sample taking and NDA measurement could be done during a few 
unannounced inspections during the year. The unannounced inspections would provide a check if 
the unattended systems are functioning nominally and if the operator did not tamper with them and 
the on-site DA of samples would avoid the sample custody issue that could lead to loss of CofK of 
an entire year’s DA sample base. 


CONCLUSION 


The analysis in this paper shows that the current safeguards approaches used by the IAEA at large 
GCEPs can be enhanced in order to provide better detection capabilities of both declared and 
undeclared LEU production using unattended NDA techniques. As shown in the examples of 
Concepts B, C, and D, the use of an unattended system that could give an overview of the entire 
process, complementary data on the enrichment process, and accurate measurements of enrichment 
and weights of the UF¢ feedstock, tails, and product is a major step in enhancing the ability of NDA 
beyond present attended systems. This possibility of monitoring the feed, tails, and product header 
pipes in such a way as to gain safeguards relevant flow and enrichment information without 
compromising the intellectual property of the operator would be a huge step forward in being able 
to monitor undeclared production. This paper shows how developments in process monitoring can 
progressively make IAEA safeguards inspections activities more effective by the use of unattended 
systems and more efficient by reducing both inspector and operator time and labor by reducing the 
need for and numbers of DA samples. The use of mass and enrichment monitoring by unattended 
systems can provide valuable process monitoring and accountancy data as well as the ability to 
verify with the advanced enrichment monitors if undeclared HEU is being produced. The use of the 
operator’s accountancy scales and load cells combined with the AEM will probably provide the 
most accurate system for measuring both the uranium mass and *35U) enrichment. However, passive 
neutron systems show promise for making independent measurements that could complement the 
other measures. Having independent measures can help cross check the data and cross authenticate 
the declarations of the operator and the data. The systems and technologies in this paper need to be 
pursued through research and development to provide instruments with the goal capabilities of low 
uncertainty and robustness that will give the IAEA enhanced safeguards at GCEPs. 
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